[#1034] Sanitizer guide and demo

[jamesnw]

Addresses #685
Fixes #1034

[rowan-m]

@jamesnw should this include an expectations.md at this point?

[rowan-m]

@jamesnw I'm wondering if this guide should:

1. Cover the less common scenario where you use setHTMLUnsafe with Sanitizer.
2. Mention Trusted Types as a way of auditing for untrusted input where you might then use Sanitizer.

However, I'm definitely posing these as open questions as I'm not immediately sure that 1. is common enough to merit adding (or maybe it's just a mention in the "Using Custom Sanitizer Configurations" section and 2. possibly makes more sense the other way round, that the Trusted Types guide should refer to Sanitizer. (https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API#sanitization_and_trusted_types)

[jamesnw]

@jamesnw should this include an expectations.md at this point?

Added, sorry!

@jamesnw I'm wondering if this guide should:

1. Cover the less common scenario where you use `setHTMLUnsafe` with `Sanitizer`.

2. Mention Trusted Types as a way of auditing for untrusted input where you might then use Sanitizer.

However, I'm definitely posing these as open questions as I'm not immediately sure that 1. is common enough to merit adding (or maybe it's just a mention in the "Using Custom Sanitizer Configurations" section and 2. possibly makes more sense the other way round, that the Trusted Types guide should refer to Sanitizer. (https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API#sanitization_and_trusted_types)

I added #1. In the Trusted Types PR I just opened, I refer to Sanitizer. Let me know if you think that's sufficient.